NETGEAR WNR2500 Firmware vulnerabilities

4 CVEs affecting NETGEAR WNR2500 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-23110, published 2023-02-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-10174: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability, published 2017-01-30. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 83.3% chance of exploitation in the next 30 days. The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated…
CVE-2016-11059, published 2020-04-28. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by password exposure. This affects AC1450 before 2017-01-06, C6300 before 2017-01-06, D500 before 2017-01-06, D1500 before 2017-01-06, D3600 before 2017-01-06,…
CVE-2023-23110, published 2023-02-02. High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days. An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured with a fixed checksum number. Therefore, an…
CVE-2017-18731, published 2020-04-24. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6100 before 1.0.1.16, R7500 before 1.0.0.112, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, and…